Organizations have a general problem of providing remote access to private networks for employees and partner organizations. Establishing a remote access link with a mobile worker or a remote business partner allows enterprises to attain productivity gains while reducing cost. Further, such links can facilitate and accelerate business-to-business (B2B) transactions.
However, employees and business partners wishing to access information remotely from another private or public network are potentially behind other security and firewall equipment, which ordinarily prevents access to the organization's network. Without a specific solution to address this issue, employees and partner organizations are not able to access information without being physically connected to the organization's private network, for example, by obtaining a network address on the organization's network to physically connect to it.
Organizations would like to solve this problem for providing remote access to trusted persons and organizations, and would like a mechanism to authenticate such users before allowing them access to the organization's network. Furthermore, since information is transmitted from the organization's private, secure, and trusted network into a public or third-party network, organizations providing such access would benefit from having this information encrypted to prevent disclosure valuable information to others.
One approach to solving this problem is to create a VPN (Virtual Private Network), such as an IPSec, PPTP, or L2TP network (referred to generally as “IPSec VPNs”). IPSec VPNs provide network-to-network communication, a “desk-like” work experience for the remote user, and are protocol independent, that is, they function at the network level rather than at the transport level. Unfortunately, VPNs do not work typically through firewalls. Traveling users, therefore, cannot connect back to their corporate resources while behind a firewall at a customer or partner site. Further, IPSec VPNs are difficult to deploy, maintain, and manage because they require intensive support and configuration, primarily due to installation and update of VPN clients on multiple machines. Typically, when deploying VPN client applications on client computers, administrators install the software interfaces on each client computer. Installation of these software interfaces usually requires administrative privileges on the client computer and may require physical access to the client computer. Such installations may be cumbersome for an information technology administrative staff to manage and deploy. A further drawback associated with IPSec VPNs is the exposure of client-side IP addresses to the accessed network, which has contributed to IPSec VPNs becoming a prime traversal route for the spread of worms, since secured clients obtain a routable IP address on the private network.
Another approach to solving this problem, which was developed attempting to solve the issues associated with IPSec VPNs while providing secure access to remote workers and business partners, is an SSL VPN. SSL VPNs primarily operate with web applications over an HTTPS connection. SSL VPNs parse web pages at runtime to ensure that every web navigation path is routable from the client computer. Since SSL VPNs provide a clientless way to access applications that are internal to an enterprise or organization network, they are easier to deploy and reduce the support issues of IPSec VPNs. Further, SSL VPNs do not expose client-side IP addresses to the accessed network.
However, there are many drawbacks associated with using SSL VPNs, including lack of client-server application support without custom connectors, the inability to work with business applications that use binary object technology such as Java applets and ActiveX, and the inability to work with peer-to-peer applications such as soft-phones.
Attempting to deploy both types of solutions and use each type for different circumstances has met with limited success because the inherent problems of each technology remain present in the combined solution. What is needed is a solution that has the combined advantages of both IPSec VPNs and SSL VPNs, but none of the shortcomings.